From 6b276a482312a6613aca0359f5f4ba05db3745bc Mon Sep 17 00:00:00 2001
From: Nariman Jelveh <nj@puter.com>
Date: Sat, 24 Oct 2026 14:44:26 -0700
Subject: [PATCH] fix(gui): stop disabling 2FA when the provider sign-in
 doesn't happen

For an account that signs in through a linked provider, turning 2FA off
opens the provider's sign-in popup. When the popup was closed or
blocked, the dialog showed why for a moment and then sent the request
anyway, whose refusal ("OIDC revalidation required") replaced the
reason. It now stops at the popup's error.
---
 src/gui/src/UI/Settings/UIWindowDisable2FA.js | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/gui/src/UI/Settings/UIWindowDisable2FA.js b/src/gui/src/UI/Settings/UIWindowDisable2FA.js
index c556323b9..6d33a4a7a 100644
--- a/src/gui/src/UI/Settings/UIWindowDisable2FA.js
+++ b/src/gui/src/UI/Settings/UIWindowDisable2FA.js
@@ -122,9 +122,10 @@ async function UIWindowDisable2FA (options) {
         hint.text(REVALIDATE_POPUP_TEXT).show();
         try {
             await openRevalidatePopup(revalidateUrl);
+            return true;
         } catch (e) {
             onError(e.message || 'Authentication failed');
-            return;
+            return false;
         } finally {
             hint.hide();
         }
@@ -153,7 +154,9 @@ async function UIWindowDisable2FA (options) {
         }
 
         if ( oidc_only && !revalidated && !password ) {
-            await myOpenRevalidatePopup();
+            // A popup closed or blocked says so; the request would only be
+            // refused, and its message would replace that.
+            if ( ! await myOpenRevalidatePopup() ) return;
 
             const res = await doSubmit({ password: undefined });
             const data = await res.json().catch(() => ({}));
@@ -178,7 +181,7 @@ async function UIWindowDisable2FA (options) {
             return;
         }
         if ( data.code === 'oidc_revalidation_required' && data.revalidate_url ) {
-            await myOpenRevalidatePopup(data.revalidate_url);
+            if ( ! await myOpenRevalidatePopup(data.revalidate_url) ) return;
             const r = await doSubmit({ password: undefined });
             if ( r.ok ) {
                 onSuccess();